Skip to content

Instantly share code, notes, and snippets.

Show Gist options
  • Save zerosign/37676803b47a045a7898bf6958b6fbda to your computer and use it in GitHub Desktop.
Save zerosign/37676803b47a045a7898bf6958b6fbda to your computer and use it in GitHub Desktop.
trace_udp_rcvbuferrors.bt
// Tracks the origin of net_udp_rcvbuferrors, printing socket metadata associated with the packet drops.
//
// usage: bpftrace trace_udp_rcvbuferrors.bt
// sample output:
// 12:32:25 iperf3/3391 ::ffff:192.168.60.3:5201 -> ::ffff:192.168.60.1:50512 retval=-1 dropped=23809 qlen=36 qsize/qmaxsize=213248/212992 bytes
kprobe:udp_queue_rcv_skb
{
$sock = (struct sock *)arg0;
if ($sock->sk_type != SOCK_DGRAM || ($sock->__sk_common.skc_family != AF_INET && $sock->__sk_common.skc_family != AF_INET6)) {
return;
}
//$usock = (struct udp_sock *)arg0;
if ($sock->__sk_common.skc_family == AF_INET) {
$daddr = ntop($sock->__sk_common.skc_daddr);
$saddr = ntop($sock->__sk_common.skc_rcv_saddr);
} else {
$daddr = ntop($sock->__sk_common.skc_v6_daddr.in6_u.u6_addr8);
$saddr = ntop($sock->__sk_common.skc_v6_rcv_saddr.in6_u.u6_addr8);
}
$lport = (uint16)$sock->__sk_common.skc_num & 0xFFFF;
$dport = $sock->__sk_common.skc_dport;
$dport = ($dport >> 8) | (($dport << 8) & 0x00FF00); // Use bwap() in later bpftrace versions to swap endianness
$dropped = $sock->sk_drops.counter;
$qlen = (uint32)$sock->sk_receive_queue.qlen;
$qsize = $sock->sk_backlog.rmem_alloc.counter;
$qmaxsize = $sock->sk_rcvbuf & 0xFFFFFFFF;
@[tid] = (1, $saddr, $lport, $daddr, $dport, $dropped, $qlen, $qsize, $qmaxsize);
}
kretprobe:udp_queue_rcv_skb
{
if (@[tid].0 != 1 || (int32)retval >= 0) {
return;
}
// Un-comment to print a summary of kernel stack traces leading to the dropped packets at the end.
//@kstacks[kstack] = count();
time("%H:%M:%S ");
printf("%s/%d\t", comm, pid);
printf("%s:%d -> %s:%d\t", @[tid].1, @[tid].2, @[tid].3, @[tid].4);
printf("retval=%d dropped=%d qlen=%u qsize/qmaxsize=%d/%d bytes\n", retval, @[tid].5, @[tid].6, @[tid].7, @[tid].8);
delete(@[tid])
}
END
{
clear(@);
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment